[isaacvarg]

Summary

Lumexia runs on the warehouse's local network, usually over plain http. Its URL in Settings went through the same rule as WooCommerce: https:// unless the host is localhost. So saving an address like http://192.168.1.20:3000 failed with "Use an https:// address."

Lumexia's URL now has its own LocalServiceUrl rule in packages/contracts/src/settings.ts:

• https:// for any host.
• http:// for a local-network host:
  • a private or loopback IPv4 address (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16);
  • loopback, unique-local or link-local IPv6 (::1, fc00::/7, fe80::/10);
  • a bare hostname (http://lumexia);
  • a .local, .lan, .internal or .home.arpa name.
• A public host still needs https://, because the API key travels in a header.
• Usernames and passwords in the URL are still refused.

WooCommerce and carrier URLs keep the stricter IntegrationUrl rule, since those services are on the internet. The new error, errors.field.urlHttpsOrLocal, says http:// works on the local network, in en and es. SPEC-lumexia.md notes the rule.

For reviewers

• The check only looks at the hostname. A private-looking name that internal DNS resolves to a public address would be accepted. That's the trade-off for letting a LAN service use http.
• A hostname with a public-looking suffix on internal DNS (e.g. lumexia.corp.example.com) still needs https.

Testing

• New contracts test: the local addresses above are accepted, and public ones are refused (http://lumexia.example.com, http://172.32.0.1, http://8.8.8.8, http://[2001:db8::1], ftp://…). It also checks that WooCommerce still refuses http://192.168.1.20.
• Contracts (127) and i18n tests, biome, and typecheck (web via tsc --noEmit, which covers e2e/) pass.
• Not tried by hand in the running app.